What Not Secure means in the address bar
Your browser says not secure because that address is still http, or the certificate is expired, for the wrong hostname, or the page still loads files over http. A site you own needs a certificate from SSL certificates, then the https address. Do not type a password on a warning you do not control.
- The address still starts with http, so the page is not encrypted.
- The certificate is expired or was issued for a different hostname.
- The page is https, but an image, stylesheet, or script still loads over http.
Not Secure is not the same as a blocked site
Read the exact words before you change the server. A grey Not Secure label beside an http address is this job. A red full-page warning is not an SSL install.
| What you see | What it means | What to do |
|---|---|---|
| Not Secure, and the address starts with http | This page has no encrypted connection | Issue a certificate, then open the https address |
| https in the address, but Not Secure or a broken lock | The certificate does not match, or some files are still http | Match the hostname, then change those file addresses |
| Full-page message: Your connection is not private | The certificate is expired or mismatched, or the device clock is wrong | Read the error, then check the certificate and the clock |
| Full-page red Dangerous warning | The browser flagged the site as unsafe | Leave. Do not enter a password. This is not the http label |
Remove the warning on a site you own
On WebJi hosting, Let's Encrypt is included and AutoSSL requests it. A paid certificate is a separate order. You do not need one to clear a plain http label. The domain's DNS must already point at this account, or AutoSSL cannot prove you control the name.
- Log in to cPanel for the domain. The billing client area is a different login.
- Open SSL/TLS Status. Tick the hostname people type, including www if you use www.
- Click Run AutoSSL. Wait until that row shows a certificate. If the row errors, copy the line and stop.
- Open a private window and load https:// plus that hostname. It is fixed on this URL when the address starts with https and Not Secure is gone.
If the row says the name does not resolve here, fix DNS first and run AutoSSL again. Buying another certificate does not repair a name that points somewhere else.
Send http visitors to the https address
A certificate does not rewrite old http links. People who type http, or follow an old bookmark, still see Not Secure until the server sends them to https. The redirect, including the WordPress address, is in the move from HTTP to HTTPS. It worked when the http address lands on https and the label is gone. Do not add a second rewrite after that test passes.
The label stays after the address is https
If the address is already https and the label remains, look past the certificate. Open the browser console and find any request that still starts with http. Change that image, stylesheet, or script to https. The lock stays off until those files move.
A certificate for the bare domain does not cover www unless both names are listed. In SSL/TLS Status, run AutoSSL for the hostname you type. An expired row needs the same run. Let's Encrypt is renewed by AutoSSL, not by a new purchase. The longer list of lock failures is in the SSL troubleshooting guide.
Every site warns, or only one browser does
If one site shows Not Secure and the rest do not, the fault is that site. If Chrome marks sites you already trust, check the date, time, and time zone on the device before you touch DNS. A wrong clock makes a valid certificate look expired.
Safari often says this connection is not secure for the same http page. The owner still fixes it with https. A visitor cannot switch the warning off.
Chrome on Android shows Not Secure to the left of the address. You can open the page. Do not enter a password or a card number. Another Android browser does not encrypt a site that is still on http. If Always use secure connections is on, Chrome may show a full Connection is not secure page when the site has no https.
When to email support
Email support@webji.services with the domain, the exact warning text, and whether SSL/TLS Status shows a certificate. Support is 24/7 by email in Hindi and English, and the average first reply is under 60 minutes. The office phone is not a support line. Do not call it for this warning.
Frequently Asked Questions
Why does my browser say not secure?
Your browser says not secure because that page is still on http, or the certificate is expired, issued for a different name, or the page loads some files over http. The label is not, by itself, a malware warning. If you own the site, run AutoSSL and open the https address. If you do not, do not type a password.
How do I fix my website saying not secure?
In cPanel open SSL/TLS Status, select the domain, and click Run AutoSSL. Open https and your hostname in a private window. If an http address still shows the label, send those visitors to https. It is fixed when Not Secure is gone on the URL people actually open.
Does Google block HTTP websites?
No. Chrome labels an http page Not Secure and still lets you open it. A full-page red Dangerous screen is a different warning about an unsafe site. Leave that page. Do not treat it as a missing certificate.
Why is Chrome saying every site is not secure?
Check the date, time, and time zone on the computer or phone first. A wrong clock makes valid certificates look expired, so the warning shows on sites that are fine. If only one hostname fails, the certificate or the files on that hostname are the cause.
Why does Safari say this connection is not secure?
Safari is naming the same problem, usually an address that still starts with http. A certificate plus https removes the warning in Safari, Chrome, and Edge. There is no Safari setting that encrypts a site you do not control.
What is mixed content, and how do I fix it?
Mixed content is an https page that still requests an image, stylesheet, or script over http. The browser console lists each blocked URL. Change those addresses to https and reload. The label clears when the console no longer reports an http request on that page.